Security, Privacy & How It All Works

Yes. Every photo and video you upload is encrypted on your device before it is stored. PicVaultPro is end-to-end encrypted at rest, but our servers are not blind: see "Can PicVaultPro staff see my photos?" for the exact list of what the server can see (for example file names and photo locations, the pre-encryption safety check, and optional AI face recognition).

How it works: 1. You set an encryption password during setup. That password is fed into Argon2id to produce a Key Encryption Key (KEK). 2. A random 256-bit Master Key is generated on your device and wrapped with the KEK. 3. Each vault gets its own random 256-bit Vault Key, wrapped by the Master Key. 4. Each file gets its own random 256-bit File Key. Files are encrypted with AES-256-GCM in 4 MB chunks.

Your encryption password is the only way to unlock the key chain. We never receive your encryption password and we do not hold an unencrypted copy of your stored files.

We use the same cryptographic building blocks trusted by governments, banks, and security-focused apps worldwide:

• AES-256-GCM — for file encryption (authenticated encryption with 128-bit auth tags).
• Argon2id — for deriving keys from your password (winner of the Password Hashing Competition, resistant to GPU attacks). Fallback: PBKDF2-SHA256 with 600,000 iterations on older browsers.
• AES Key Wrap (RFC 3394) — for wrapping keys inside other keys in the hierarchy.
• RSA-OAEP 2048-bit — for sharing vault keys with partners (asymmetric key exchange).
• SHA-256 — for checksums, salt derivation, and integrity verification.

Every random value is generated with the platform's cryptographically-secure random number generator.

Encrypted on your device (we cannot read the contents): • Photo and video files (full resolution originals) • Thumbnails generated for the gallery grid • File encryption keys (wrapped with your vault key)

Encrypted, but with a key PicVaultPro holds (we can technically read it): • Face recognition embeddings (opt-in only)

Readable by us (protected by Row Level Security and TLS): • File names, sizes, types and upload dates • Capture time and location from photo metadata (coordinates, city, state, country) • Vault, collection, tag and people names, and share records • Account details (email, phone, billing) and activity logs

Readable by our servers only while a feature runs: • Image content during the pre-encryption safety check and, if you opt in, AI face recognition • A temporary file key during video playback in the mobile apps

Metadata visibility lets features like date sorting, location grouping, and search work without decrypting every file.

If an attacker stole our entire database and storage, they would have: • Encrypted files — useless without your password-derived key • Hashed passwords — not reversible • Wrapped encryption keys — can't be unwrapped without your password • Encrypted face embeddings — encrypted with a server-held key, so an attacker who also obtained that key could read them • Readable metadata — file names, photo locations, and the names you created

Your photo and video contents would remain unreadable. This is the point of encrypting on your device. Your metadata would not.

No. Your photo and video contents are encrypted on your device before they are uploaded, and PicVaultPro holds no standing key that can decrypt your stored files. Staff cannot browse your photos or videos.

PicVaultPro is end-to-end encrypted at rest. That does not mean our servers see nothing. This is exactly what the server can see: • Readable by us: file names, capture time, location from photo metadata (coordinates, city, state, country), file type and size, and the vault, collection, tag and people names you create. Account details such as your email, phone number and billing records, and activity logs, are readable too. • To show place names, the GPS coordinates from your photos (coordinates only) are sent to OpenStreetMap's Nominatim service. On the web this lookup also runs in your browser during upload, so Nominatim sees your IP address. • We do not currently run automated scanning on your uploads. • If you turn on AI face recognition, the image is sent to our AI server in memory before it is encrypted, and the face data is stored encrypted with a key PicVaultPro holds, so we can technically read it. • When a mobile app plays an encrypted video, it gives our server a temporary file key (about 10 minutes) so the server can decrypt the video in memory. Video "Analyze with AI" does the same.

There is no admin key and no escrow copy of your encryption key. The keys that unlock your stored files are your encryption password and 24-word recovery phrase, which stay with you, plus, for a vault you choose to share, the account you shared it with.

If you lose both your encryption password and your recovery phrase, your photos and videos cannot be recovered by anyone, including us.

During encryption setup you receive a 24-word recovery phrase (BIP39 standard). It unlocks a second, separately wrapped copy of your master encryption key.

Why it matters: • If you forget your encryption password, the recovery phrase is the only way to regain access to your encrypted data. • If you lose both your password and your recovery phrase, your data cannot be recovered by anyone, including us. • The phrase is shown once, at setup, and cannot be shown again. It is never sent to us; we keep only a one-way hash of part of it to check that you entered it correctly. Write it down and keep it somewhere safe.

Yes, in two layers:

• Layer 1 — Application encryption: Files are AES-256-GCM encrypted on your device before upload.
• Layer 2 — Transport encryption: All connections use TLS 1.2+ with HSTS preloading, so even the encrypted bytes cannot be intercepted in transit.

Every connection — to our app, to our database, to our AI server, to Stripe — is HTTPS-enforced.

When you opt in to AI features, your photos are sent directly from your device to our dedicated AI server (Onyx) over HTTPS for face detection. The AI server creates mathematical embeddings — 512-dimensional numerical vectors like [0.234, −0.156, 0.892, …]. These are not images or photographs. They cannot be reverse-engineered into a face.

How AI works with encrypted files:

1. Your device sends the plaintext image directly to our AI server over HTTPS — before encrypting the file.
2. The AI server processes the image in memory, generates embeddings and face thumbnails, then returns them to your device.
3. Your device encrypts the face thumbnails with your file key, then sends the encrypted thumbnails and embeddings to PicVaultPro for storage.
4. PicVaultPro's storage servers never receive your plaintext photos. Only the AI server does, and only when you turn on face recognition, briefly in memory.

Embeddings are used to group photos of the same person together — like a smart album.

What AI never does:

• Never stores your photos on the AI server (processed in memory only).
• Never builds cross-user profiles or identity graphs.
• Never infers sensitive attributes (race, age, gender, disability).
• Never shares your biometric data with third parties.

No. PicVaultPro's AI detects and matches faces only. It does not analyze tattoos, clothing, or body features.

• A person whose face isn't visible is simply not tagged automatically — you can still draw a face box and tag them yourself.
• Face matching is strictly within your own library. No cross-user matching ever occurs.

Your photos never go to a third-party AI. • Runs on PicVault's own AI server, not OpenAI, Google or any outside AI service • Photos are analyzed in memory and not kept • Your face data stays in your account: only you and people you choose to share with • Your photos are never used to train AI for anyone else. Face matching learns only from your own photos and the ones shared with you. • Face data is encrypted when stored

Absolutely. AI is off by default and completely optional. Encryption is always on regardless.

Free accounts are limited to 50 photos per month for AI face detection (counted per photo, not per face). Free accounts can also keep up to 10 people. Pro and Premium plans include unlimited AI face detection and people.

When you disable AI: • All face embeddings are permanently deleted. • Person groupings are removed. • This is irreversible — re-enabling starts from scratch.

In the PicVaultPro Android app, AI face recognition is opt-in. On the Safety & Legal step of setup, the AI checkbox starts unticked, and you can leave it unticked and still continue. A card titled "How safe is PicVault AI?" appears above the checkbox.

To change your choice later, open Settings → Privacy and use the "Turn on AI face recognition" switch. The same card appears above it.

On the web, AI face recognition is opt-in. On the Safety & Legal step of signup, the AI checkbox ("Turn on AI face recognition") starts unticked. A card titled "How safe is PicVault AI?" appears above it. You can leave it unticked and still continue; your account is then created with AI off.

To change your choice later, open Settings → Privacy (the page is titled Privacy & Security) and use the "AI-assisted features" switch. The same card appears above it.

When it is on, face recognition detects faces in your photos and groups photos of the same person so you can name them. Your photos are sent to PicVault's own AI server for analysis. What is kept is face data: small face thumbnails and numerical face vectors (not photographs), stored in your account. Turning it off permanently deletes your face data.

Your photos are never used to train AI for anyone else. Face matching learns only from your own photos and the ones shared with you.

In the PicVaultPro iOS app, AI face recognition is opt-in. On the Safety & Legal step of setup, the AI checkbox ("Turn on AI face recognition") starts unticked, and you can leave it unticked and still continue. A card titled "How safe is PicVault AI?" appears above it, with a short "What's shared when AI is on" summary beneath it.

To change your choice later, open Settings → Privacy & Security and use the "Turn on AI face recognition" switch. The same card appears above it, and a note under the switch explains that turning it on uploads your photos to PicVault's own AI server to detect faces. Turning the switch on shows a consent sheet first.

The "What's shared when AI is on" summary lists what is sent, where it goes, what it is never used for, and training.

Your photos are never used to train AI for anyone else. Face matching learns only from your own photos and the ones shared with you.

If you lose both your encryption password and your recovery key, PicVault cannot recover your data. Keep your recovery key (the 24-word recovery phrase shown at encryption setup) somewhere safe. To use it, go to Settings > Recovery (the screen is titled Recover Encryption), or tap "Forgot password?" on the unlock screen.

When you export a photo or video to other apps, the iOS app asks "Export from PicVault?" first. Exporting sends a decrypted copy outside PicVault, and PicVault can't protect or take back the copy once it leaves.

Face embeddings are: • Encrypted at rest with AES-256-GCM using a dedicated key that PicVaultPro holds, not your vault key. That means we can technically read them. • Protected by Row Level Security — other users cannot query your embeddings • Never sold, leased, or shared with third parties • Permanently deleted when you opt out, use "Delete All AI Data", or delete your account • Not included in your data export

These are numerical vectors, not photographs. AI in PicVaultPro is face-only: body and tattoo analysis do not exist.

Continuous AI Background Scanning — PicVaultPro automatically scans new photos you upload and suggests face detections in your tagging queue. You don't need to manually trigger rescans; it happens silently in the background.

Want to scan your whole vault? Use the Reset & Rescan button on the Tagging page to re-run face detection on every photo in the vault so newly detected faces show up in your tagging queue.

Your confirmed tags are preserved. Faces you've already assigned to a named person stay linked to that person — rescanning only refreshes detections and the review queue, it does not wipe your work.

Large libraries are handled automatically. PicVaultPro processes photos in batches of 200, advancing through the whole vault in one click. You'll see a cumulative counter like “batch 3, chunk 45/200 (645/1400 overall)” as it runs. Press Stop at any time to cancel — encrypted rescans will finish with a “Scan cancelled at X/Y encrypted photos” message, and progress up to that point is kept.

The owner of a vault, collection, slideshow or photo can share it, and an active partner can share photos and videos from a vault they are a partner of (not Fort Knox). Partners cannot share the vault, collections or slideshows. You share with a person: pick someone from your People directory (they need an email address, a phone number, or a linked PicVault account) and choose a role.

1. Person with a PicVault account — they get a pending share to accept. 2. Person without an account — they receive an invitation by SMS (phone number) or email and create a free account to accept. 3. Encrypted invite link (before they sign up) — you enter their email or phone and get a one-time link. The link is tied to that email or phone and still needs a PicVault account; it is not an anonymous public link.

Sharing a vault, collection or slideshow works from its Share button. A single photo or video is shared from its detail view. Vault sharing needs a Pro or Premium plan (Pro: up to 10 people per vault; Premium: unlimited). Fort Knox and partner vaults cannot be shared.

Invites expire: share invitations after 30 days, encrypted invite links after 14 days by default, SMS invites after 48 hours, and invitations to join PicVault after 7 days.

They can still receive it, but they need a free PicVault account to open it.

• Email — they receive an invitation with a link to accept. They sign in or create a free account, and access is granted once they accept. • SMS — they receive a text message with a link. Phone invites expire after 48 hours. • Encrypted invite link — you enter their email or phone and send them a one-time link. After they sign up they claim the share. The link expires after 14 days by default.

To view encrypted content they also need to finish their own encryption setup and unlock their vault.

Yes, if you already have a PicVault account. On the web, the link remembers where you were going: sign in, enter your text code, and you land on the shared item instead of the dashboard. If you're new, create your account and finish setup first, then open the link again or find the share under Shared with me. Invitation links sent to you by email or text only work for you, so sign in with the same email or phone the invitation went to.

Your photos stay locked on the sender's device until it hands you the key, so a new share can take a moment to open. In newer versions of the iOS app you may see "Waiting for the sender to open PicVault". Ask them to open PicVault on their phone or computer while they're online; it usually opens on its own once they do. If it still isn't ready after about 10 minutes, the app tells you it's taking longer than usual, and you can dismiss it and try again later.

No. Every share goes to a specific person, so you need their email address, their phone number, or their linked PicVault account. There is no public or anonymous link: PicVaultPro does not create a link that anyone can open.

The "encrypted invite link" is for people who have not signed up yet. It is tied to the email or phone you entered, works once, and the recipient still needs a free PicVault account.

Only you and people you explicitly share with. Other users cannot search for or discover your content. There is no public profile, no feed, no explore page. You can revoke access at any time.

Only the owner can share your vault, collections and slideshows, and an active partner can also share photos and videos from your non-Fort-Knox vaults. People you share with, including Viewers and Editors, cannot share your vault, collection, slideshow or photos with anyone else through PicVaultPro.

As with any digital content, a person who can see something could screenshot it or download it if you allowed downloads. PicVaultPro controls access, not screen capture.

Viewer: can view what you shared. Cannot download originals, upload, tag, or organize.

Editor: can view, download originals, upload, delete their own uploads, add to and create collections, tag existing people, and edit metadata. Editors cannot delete other people's media, rename or merge people, share with anyone else, rename or delete the vault, or change sharing settings.

When you share a single photo or video you can also choose "View + Download" (view and save the original, nothing else). On a slideshow, Viewers can play it. Editors can play it, and on the web today they can also add their own uploaded photos and remove photos they added (the iOS and Android apps are rolling out); they can't rename, reorder, delete or share it, and photos from a Fort Knox vault can't be added.

Owners can share, and active partners can share photos and videos from non-Fort-Knox vaults. If a partnership ends, shares the partner created from your vaults are revoked, and as the owner you can revoke any share of your own vault's media. If a recipient's plan is downgraded, their Editor roles can drop to Viewer.

Right away for new requests. When you revoke a share, the recipient can no longer open it or request new links. A link they already loaded stops working within about 5 minutes when it expires and cannot be renewed.

Revoking does not undo what a recipient already downloaded or decrypted. Anything saved to their device stays with them. When you revoke a vault share you can keep the editor's uploads in your vault or delete them.

Fort Knox is an ultra-secure vault mode: • An SMS verification is required to open it • Access sessions last 30 minutes and extend while you keep using the vault, then you must re-verify • Hidden from default views and from People and search while locked • Cannot be shared or invite-linked

Available on Pro and Premium plans.

If you delete a Fort Knox item, it stays protected in Trash — the thumbnail stays blurred and locked until you open an active Fort Knox session.

Yes. A Collection is a saved group of photos and videos inside one vault, built from filters (such as people, tags, dates or places) and/or items you choose. Collections never cross vaults.

You can share a collection from its Share button. Recipients see only that collection, not your whole vault. Roles are Viewer (view only) or Editor. Only you, the owner, can share it, and you can revoke at any time.

Free plans can keep up to 3 collections. Collections built from filters require Pro or Premium.

A Slideshow is a saved, ordered set of your photos and videos with a transition (fade, slide or zoom) and a time per slide (1 to 30 seconds, default 5). Slideshows are available on Pro and Premium.

Select photos in your vault and choose Slideshow to create one, then open it to play full screen. Encrypted slideshows need the vault to be unlocked. You can share a slideshow with a person as a Viewer (they can play it) or an Editor (on the web today they can also add their own photos and remove the ones they added; the iOS and Android apps are rolling out). Only you can rename, reorder, delete or share it. If an Editor adds photos, other people may need to wait a moment for the Editor's device to sync keys before they can see them.

PicVaultPro can suggest collections based on when and where your photos were taken — like a trip or an event. These are suggestions only, built from photo dates and locations.

How to manage them: • Accept: Creates a new collection with the suggested photos. You can rename it immediately. • Dismiss: Closes the suggestion without creating anything. You won't see it again. • Each suggestion shows a preview thumbnail.

Memory suggestions are optional — they appear alongside your manually created collections. You can organize your library your own way.

PicVaultPro records account activity such as logins, uploads, shares, and AI operations. You can turn activity logging off in Privacy Settings. • Contact support to review account activity if you suspect unauthorized access • If something looks wrong, change your password immediately

We respond to valid legal orders (subpoenas, warrants) as required by law. However:

• We cannot provide decrypted photos — we do not hold your encryption keys.
• We can provide account metadata (email, signup date, IP logs) if legally compelled.
• You will be notified of any data request when we are legally permitted to do so.

Full details are in our Privacy Policy.

Yes. We support the full set of data subject rights:

• Right to access — export all your data at any time.
• Right to deletion — delete your account and all associated data.
• Right to portability — download your photos in their original formats.
• Right to opt out — disable AI features, biometric data deleted immediately.
• Right to correct — edit your profile information.

You can submit a formal data access request via the link in our Privacy Policy.

Your encrypted photos are yours. You can download them at any time from your vaults. There is no vendor lock-in.

In the unlikely event of a shutdown, we would provide advance notice and a grace period to download all your content.

No. PicVaultPro does not sell your data, and does not serve ads in the app. Our revenue comes from subscriptions. Our public marketing website (not the app or your vault) uses the Meta Pixel to measure ad performance.

PicVaultPro may use automated safety systems solely for compliance and abuse-prevention purposes.

This safety process is separate from optional AI features, does not power ads or recommendations, and is not a guarantee that every prohibited file is proactively detected. When we obtain actual knowledge of prohibited content, we preserve records and report as required by law. Full details are in our Safety Policy.

Partner sharing links you with one other person. It does not create a separate "partner vault".

When your partner accepts: • You each get full, reciprocal access to all of each other's existing vaults. Fort Knox vaults still need their own SMS verification. • Only a Pro or Premium member can send a partner invite. • The person who accepts inherits the inviter's plan and storage quota for as long as the partnership lasts. Their own paid subscription, if any, is paused.

Vault keys are shared by RSA-OAEP key exchange: your partner's public key wraps a copy of the vault key so they can decrypt without knowing your password.

Either partner can end the partnership at any time from the Partner page. When it ends: • Each partner's access to the other's vaults is removed. • Shares a partner created from the other person's vaults are revoked. The owner can also revoke any share of their own vault's media at any time. • The partner who inherited a plan goes back to their own plan (or Free), and a paused subscription resumes. • Each person keeps their own vaults and what they already own. Anything a partner already downloaded or decrypted stays with them: ending a partnership does not erase copies.

Yes, a partner has full access to the vaults they are connected to, including viewing and downloading. Only add someone you trust as a partner. You can end the partnership at any time, which removes their access to your vaults going forward.

We strongly recommend it. Your login password authenticates you to our servers (where it is hashed and stored by our auth provider). Your encryption password never leaves your device — it derives the key that protects your photos.

Using two different passwords means that even if your account credentials were ever compromised in a breach, an attacker would still need to separately crack your encryption password (protected by Argon2id) to access your encrypted files.

During encryption setup we remind you of this, but we don't enforce it as a hard rule — we trust you to make the right choice for your threat model.

There are two separate passwords.

• Login password (your PicVaultPro account): use "Forgot password" on the sign-in page to reset it by email. This does not touch your photos. • Encryption password (unlocks your photos): if you forget it, enter your 24-word recovery phrase in Settings → Key Recovery to set a new one.

If you've lost both your encryption password and your recovery phrase, your encrypted data cannot be recovered. See "What happens if I lose my encryption password and recovery phrase?".

Your photos and videos cannot be recovered. PicVaultPro does not hold a key that can decrypt them, and support cannot unlock your vault. The recovery phrase is shown once at setup and cannot be shown again, so keep it somewhere safe and separate from your phone or computer.

If you only forget your encryption password and still have the phrase, use Settings → Key Recovery.

PicVaultPro uses SMS verification as the second factor, and it is required for every account (it is set up during onboarding). After you verify, the same browser may not ask again for up to 24 hours, even if you were signed out for being idle. Fort Knox vaults require an extra SMS verification each time you open them.

Yes, for every account. You add and verify a phone number during signup, before you can use your vaults.

Web: you are signed out after 15 minutes without activity by default (you can choose 5, 15 or 30 in Settings → Privacy) or after 5 minutes with the tab hidden. The server also ends any session after 2 hours of inactivity. Signing out clears your encryption keys, so you need your encryption password next time.

iOS and Android: the vault locks (keys cleared) after 5 minutes in the background, and you are fully signed out after 2 hours of inactivity. The auto-lock setting does not extend the 5-minute background lock.

Uploads in progress keep a session alive. Fort Knox vault sessions last 30 minutes and extend while you keep using them. There is no "sign out of all devices" control; each device ends its own session.

Yes. In the app, go to Settings → Account → Delete My Account. Account deletion is immediate and permanent. It removes: • All photos and videos (encrypted files) • All metadata, tags, and person groupings • All encryption keys • Your profile and account information

This cannot be undone and there is no recovery. If you subscribed through Google Play, deletion cancels that subscription first; if Google does not confirm the cancellation, your account is not deleted and you can try again. An Apple App Store subscription cannot be cancelled by PicVaultPro: cancel it in iPhone Settings → your name → Subscriptions, or Apple keeps billing you. A subscription bought on the website is cancelled as part of deletion. We recommend exporting what you need before you delete.

• Free: 1 GB, 1 vault, 3 collections, 10 people, AI face detection (50 photos per month) • Pro ($9.99/mo): 100 GB, 5 vaults, unlimited collections and people, unlimited AI, slideshows, partner sharing, Fort Knox, vault sharing with up to 10 people per vault • Premium ($19.99/mo): 500 GB, 10 vaults, all Pro features, vault sharing with unlimited people

Need more? Storage add-ons are available at $3.99/month per 100 GB block on any paid plan.

Storage is measured by encrypted file size (slightly larger than originals due to encryption overhead).

Deleted items move to Trash and stay there for 30 days. Each item shows a countdown badge so you know exactly how much time is left. Items with 3 days or fewer remaining are highlighted in red.

After 30 days, items are permanently deleted — files are removed from storage and cannot be recovered. You can also permanently delete items early by using "Empty Trash" or selecting specific items to remove.

Yes. Every account can use the Free plan — 1 GB of encrypted storage, free forever, no credit card required. You can also start with a 7-day trial of Premium features (30 days if you were referred). Upgrade to Pro or Premium anytime for more storage and features, and cancel whenever you like.

Stripe processes all payments. PicVaultPro never sees, stores, or touches your credit card details. Stripe is PCI-DSS Level 1 certified — the highest level of payment security compliance.

Yes, cancel anytime from Settings → Billing. No lock-in, no cancellation fees. Your encrypted photos remain accessible — you can export everything before downgrading. If you exceed the free-tier storage limit, you will need to remove files or purchase a plan to upload more.

Photos: JPEG, PNG, GIF, WebP, HEIC, HEIF, BMP, TIFF.

Videos: MP4, MOV, WebM, AVI, MKV, 3GP, M4V.

Per-file size limits by plan: Free — 500 MB, Pro — 1 GB, Premium — unlimited.

Batch uploads support up to 2,500 files per session. Large files use resumable chunked uploads with streaming encryption so they won't crash your browser.

Those services encrypt your data on their servers. They hold the keys and can access your content — for recommendations, AI features, and compliance with requests.

PicVaultPro encrypts on your device before upload. We hold no standing key for your stored contents. The differences:

• Encryption: Client-side (PicVault) vs. server-side (Google/Apple/Microsoft).
• Staff access to photo and video contents: No standing key (PicVault) vs. technically possible. Metadata is readable by us either way.
• Partner features: Purpose-built partner sharing (PicVault) vs. generic sharing links.

A local encrypted folder gives you encryption, but:

• No cloud storage — a disk failure or theft can mean total loss.
• No secure sharing — you cannot grant someone remote, revocable access.
• No audit trail — no record of who accessed what.
• No organization — no AI face grouping, location views, or collections.
• No multi-device access — locked to one machine.

PicVaultPro gives you the same encryption with cloud storage, controlled sharing, and modern photo management.